# cve.now: NuGet packages

The newest entries affecting NuGet packages (up to 200). To check exact package versions, use the MCP stack.check operation or /stack.

- [GHSA-6856-87HX-P5X7](https://cve.now/GHSA-6856-87HX-P5X7.md): Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability (medium (no CVSS), Microsoft.TestPlatform.CLI)
- [CVE-2026-118740](https://cve.now/CVE-2026-118740.md): Aspire Security Feature Bypass Vulnerability (CVSS 9.1, Microsoft Aspire Dashboard · Microsoft Aspire.Dashboard.… +7)
- [CVE-2026-120796](https://cve.now/CVE-2026-120796.md): .NET Denial of Service Vulnerability (CVSS 5.3, Microsoft .NET 11.0 installed on Linux · Microsoft .NET… +14)
- [CVE-2026-120778](https://cve.now/CVE-2026-120778.md): Aspire Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Aspire.Cli · Aspire.Cli +11)
- [CVE-2026-120792](https://cve.now/CVE-2026-120792.md): Aspire Information Disclosure Vulnerability (CVSS 7.3, Microsoft Aspire.Cli · Aspire.Cli +11)
- [CVE-2026-118750](https://cve.now/CVE-2026-118750.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft.AspNetCore.WebUtilities)
- [CVE-2026-118749](https://cve.now/CVE-2026-118749.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 11.0 installed on Linux · Microsoft .NET… +14)
- [CVE-2026-118748](https://cve.now/CVE-2026-118748.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 11.0 installed on Linux · Microsoft .NET… +13)
- [CVE-2026-118747](https://cve.now/CVE-2026-118747.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft System.Formats.Cbor · System.Formats.Cbor)
- [CVE-2026-118745](https://cve.now/CVE-2026-118745.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 installed on Windows · Microsoft .NE… +6)
- [CVE-2026-120006](https://cve.now/CVE-2026-120006.md): Aspire Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Aspire.Hosting · Microsoft Aspire.Hosting.AppH… +2)
- [CVE-2026-114159](https://cve.now/CVE-2026-114159.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 installed on Windows · Microsoft .NE… +6)
- [CVE-2026-114158](https://cve.now/CVE-2026-114158.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 installed on Windows · Microsoft .NE… +6)
- [CVE-2026-114157](https://cve.now/CVE-2026-114157.md): ASP.NET Core Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft .NET 10.0 installed on Windows · Microsoft .NE… +6)
- [CVE-2026-114156](https://cve.now/CVE-2026-114156.md): ASP.NET Core Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft .NET 11.0 installed on Linux · Microsoft .NET… +13)
- [CVE-2026-114155](https://cve.now/CVE-2026-114155.md): .NET Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +3)
- [CVE-2026-114154](https://cve.now/CVE-2026-114154.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 installed on Windows · Microsoft .NE… +6)
- [CVE-2026-114152](https://cve.now/CVE-2026-114152.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 installed on Windows · Microsoft .NE… +6)
- [CVE-2026-114151](https://cve.now/CVE-2026-114151.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 installed on Windows · Microsoft .NE… +6)
- [CVE-2026-114150](https://cve.now/CVE-2026-114150.md): ASP.NET Core Information Disclosure Vulnerability (CVSS 5.9, Microsoft .NET 11.0 installed on Linux · Microsoft .NET… +13)
- [CVE-2026-114149](https://cve.now/CVE-2026-114149.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +23)
- [CVE-2026-114147](https://cve.now/CVE-2026-114147.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +23)
- [CVE-2026-114146](https://cve.now/CVE-2026-114146.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +23)
- [CVE-2026-109481](https://cve.now/CVE-2026-109481.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft .NET 11.0 installed on Linux · Microsoft .NET… +13)
- [CVE-2026-109478](https://cve.now/CVE-2026-109478.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 8.0 installed on Linux · Microsoft .NET… +16)
- [CVE-2026-109476](https://cve.now/CVE-2026-109476.md): ASP.NET Core Information Disclosure Vulnerability (CVSS 6.1, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +22)
- [CVE-2026-109475](https://cve.now/CVE-2026-109475.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +14)
- [CVE-2026-105544](https://cve.now/CVE-2026-105544.md): Microsoft local privilege escalation in access control (CVSS 7.5, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +12)
- [CVE-2026-123805](https://cve.now/CVE-2026-123805.md): SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS) (CVSS 7.5, sipsorcery-org sipsorcery · SIPSorcery)
- [CVE-2026-114456](https://cve.now/CVE-2026-114456.md): Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers (CVSS 6.5, snowflake-connector-python · github.com/snowflakedb/gosn… +9)
- [CVE-2026-103582](https://cve.now/CVE-2026-103582.md): Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS) (CVSS 7.5, Apache Software Foundation Apache.NMS.ActiveMQ)
- [GHSA-P3JP-9V83-76W9](https://cve.now/GHSA-P3JP-9V83-76W9.md): Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability (high (no CVSS), Microsoft.DotNet.ILCompiler · Microsoft.NETCore.App.Run… +75)
- [CVE-2026-62847](https://cve.now/CVE-2026-62847.md): Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS) (CVSS 8.2, Metalama · Metalama.Framework +1)
- [CVE-2026-62848](https://cve.now/CVE-2026-62848.md): Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution (CVSS 7.3, Metalama · Metalama.Framework)
- [GHSA-473Q-M89C-GHF8](https://cve.now/GHSA-473Q-M89C-GHF8.md): MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificat (medium (no CVSS), MySqlConnector)
- [CVE-2026-116675](https://cve.now/CVE-2026-116675.md): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` serialization (CVSS 8.5, tinymce · tinymce/tinymce)
- [CVE-2026-92707](https://cve.now/CVE-2026-92707.md): MessagePack: Nested arrays can blow past buffer length limits (CVSS 5.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-102870](https://cve.now/CVE-2026-102870.md): ASP.NET Core Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +7)
- [CVE-2026-88092](https://cve.now/CVE-2026-88092.md): ASP.NET Core Tampering Vulnerability (CVSS 9.4, Microsoft ASP.NET Core · Microsoft Visual Studio +12)
- [CVE-2026-70197](https://cve.now/CVE-2026-70197.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.1, Microsoft .NET 10.0 installed on Linux · Microsoft .NET… +18)
- [CVE-2026-106118](https://cve.now/CVE-2026-106118.md): ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106117](https://cve.now/CVE-2026-106117.md): ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp (CVSS 7.5, SixLabors ImageSharp · ImageSharp)
- [CVE-2026-106116](https://cve.now/CVE-2026-106116.md): ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106115](https://cve.now/CVE-2026-106115.md): ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106114](https://cve.now/CVE-2026-106114.md): ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106113](https://cve.now/CVE-2026-106113.md): ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106112](https://cve.now/CVE-2026-106112.md): ImageSharp: ICC LUT16 output channel count can write beyond Vector4 (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106111](https://cve.now/CVE-2026-106111.md): ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate (CVSS 5.9, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106110](https://cve.now/CVE-2026-106110.md): ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-105796](https://cve.now/CVE-2026-105796.md): Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators (CVSS 8.8, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-105795](https://cve.now/CVE-2026-105795.md): Kiota: Unsafe oauth\_card\_path references in Kiota-generated API plugin manifests (CVSS 3.1, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-105794](https://cve.now/CVE-2026-105794.md): MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL (CVSS 9.1, microsoft msquic · Microsoft.Native.Quic.MsQuic.OpenSSL)
- [CVE-2026-100369](https://cve.now/CVE-2026-100369.md): CliInvoke: Argument Injection in Extensibility Runner Factory (CVSS 8.4, alastairlundy CliInvoke · AlastairLundy.CliInvoke +1)
- [CVE-2026-100368](https://cve.now/CVE-2026-100368.md): CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers (CVSS 8.4, alastairlundy CliInvoke.Specializations · CliInvoke.Spec… +1)
- [CVE-2026-61570](https://cve.now/CVE-2026-61570.md): MPXJ: XXE Vulnerability in MerlinReader (CVSS 7.5, joniles mpxj · net.sf.mpxj:mpxj +5)
- [CVE-2026-65829](https://cve.now/CVE-2026-65829.md): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (CVSS 5.3, joniles mpxj · mpxj +5)
- [CVE-2026-69197](https://cve.now/CVE-2026-69197.md): Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion (CVSS 8.7, Umbraco-CMS · Umbraco.Cms)
- [CVE-2026-81515](https://cve.now/CVE-2026-81515.md): Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) (CVSS 7.5, SteeltoeOSS security-advisories · Steeltoe.Discovery.Eureka)
- [CVE-2026-81516](https://cve.now/CVE-2026-81516.md): Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) (CVSS 7.5, SteeltoeOSS security-advisories · Steeltoe.Discovery.Consul)
- [CVE-2026-81868](https://cve.now/CVE-2026-81868.md): Steeltoe: Header-forwarded client cert lacks proof of private-key possession (CVSS 6.5, SteeltoeOSS security-advisories · Steeltoe.Security.Authori…)
- [CVE-2026-75523](https://cve.now/CVE-2026-75523.md): Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets (CVSS 5.9, SteeltoeOSS security-advisories · Steeltoe.Management.Endpo…)
- [CVE-2026-75513](https://cve.now/CVE-2026-75513.md): Marten: SQL injection in Marten's LINQ provider via unescaped string literals (CVSS 9.1, JasperFx marten · Marten)
- [CVE-2026-85756](https://cve.now/CVE-2026-85756.md): SSH.NET: ScpClient allows server-side RCE via default SCP path handling (CVSS 7.5, sshnet SSH.NET · SSH.NET)
- [CVE-2026-54632](https://cve.now/CVE-2026-54632.md): SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) (CVSS 7.5, sipsorcery-org sipsorcery · SIPSorcery)
- [CVE-2026-81192](https://cve.now/CVE-2026-81192.md): OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS (CVSS 7.0, open-telemetry opentelemetry-dotnet-contrib · OpenTelemetry…)
- [CVE-2026-71328](https://cve.now/CVE-2026-71328.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime +6)
- [CVE-2026-69304](https://cve.now/CVE-2026-69304.md): ASP.NET Core Denial of Service Vulnerability (CVSS 5.9, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +7)
- [CVE-2026-69439](https://cve.now/CVE-2026-69439.md): .NET and Visual Studio Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime +6)
- [CVE-2026-72923](https://cve.now/CVE-2026-72923.md): Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion (CVSS 7.5, microsoft OpenAPI.NET · Microsoft.OpenApi.YamlReader +1)
- [CVE-2026-69522](https://cve.now/CVE-2026-69522.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime +8)
- [CVE-2026-86600](https://cve.now/CVE-2026-86600.md): Workload identity attestation generated before login host validation in Snowflake drivers (CVSS 8.2, snowflake-connector-python · github.com/snowflakedb/gosn… +9)
- [CVE-2026-48796](https://cve.now/CVE-2026-48796.md): CefSharp: FolderSchemeHandlerFactory path boundary check can expose files outside the configured root folder (CVSS 5.3, CefSharp · CefSharp.Common)
- [CVE-2026-54570](https://cve.now/CVE-2026-54570.md): AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass (CVSS 6.9, AngleSharp)
- [CVE-2026-48798](https://cve.now/CVE-2026-48798.md): SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames (CVSS 7.1, sshnet SSH.NET · SSH.NET)
- [CVE-2026-73851](https://cve.now/CVE-2026-73851.md): Kiota: Path traversal in generated plugin manifest static\_template.file reference (percent-encoding bypass) (CVSS 6.1, microsoft kiota · Microsoft.OpenApi.Kiota)
- [CVE-2026-74795](https://cve.now/CVE-2026-74795.md): Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74794](https://cve.now/CVE-2026-74794.md): Scriban before 6.6.0 Denial of Service via Infinite Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74792](https://cve.now/CVE-2026-74792.md): Scriban before 7.0.0 Stack Overflow via nested array initializers (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74791](https://cve.now/CVE-2026-74791.md): Scriban before 7.0.0 Authorization Bypass via Stale Include Cache (CVSS 9.2, scriban · Scriban.Signed)
- [CVE-2026-74790](https://cve.now/CVE-2026-74790.md): Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache (CVSS 9.3, scriban · Scriban.Signed)
- [CVE-2026-74789](https://cve.now/CVE-2026-74789.md): Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74788](https://cve.now/CVE-2026-74788.md): Scriban before 7.0.0 Denial of Service via string.pad\_left/pad\_right (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74787](https://cve.now/CVE-2026-74787.md): Scriban before 7.0.0 Uncontrolled Recursion via object.to\_json (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74786](https://cve.now/CVE-2026-74786.md): Scriban before 7.0.0 Denial of Service via Unbounded Template Output (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74785](https://cve.now/CVE-2026-74785.md): Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74784](https://cve.now/CVE-2026-74784.md): Scriban before 7.2.0 Denial of Service via array.insert\_at (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74783](https://cve.now/CVE-2026-74783.md): Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73062](https://cve.now/CVE-2026-73062.md): Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73061](https://cve.now/CVE-2026-73061.md): Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor (CVSS 9.3, scriban)
- [CVE-2026-62898](https://cve.now/CVE-2026-62898.md): Microsoft QUIC Information Disclosure Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +7)
- [CVE-2026-70354](https://cve.now/CVE-2026-70354.md): .NET Core Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8)
- [CVE-2026-62886](https://cve.now/CVE-2026-62886.md): .NET Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8)
- [CVE-2026-62902](https://cve.now/CVE-2026-62902.md): .NET Information Disclosure Vulnerability (CVSS 6.5, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +6)
- [CVE-2026-62897](https://cve.now/CVE-2026-62897.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.0, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +11)
- [CVE-2026-62946](https://cve.now/CVE-2026-62946.md): ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds (CVSS 5.1, ImageMagick · Magick.NET-Q16-AnyCPU +5)
- [CVE-2026-62363](https://cve.now/CVE-2026-62363.md): ImageMagick: Heap Buffer Over-Write in fx operation (CVSS 5.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-62343](https://cve.now/CVE-2026-62343.md): ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided (CVSS 4.7, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55969](https://cve.now/CVE-2026-55969.md): Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c\_glib, Go, netstd, Delphi and Haxe bindings (CVSS 8.7, Apache Software Foundation Apache Thrift · Apache Softwa… +1)
- [CVE-2026-66011](https://cve.now/CVE-2026-66011.md): ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-45785](https://cve.now/CVE-2026-45785.md): OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle (CVSS 6.2, openmcdf)
- [CVE-2026-55254](https://cve.now/CVE-2026-55254.md): NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation (CVSS 4.8, ncalc · NCalc.Core +1)
- [CVE-2026-50273](https://cve.now/CVE-2026-50273.md): Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-dotnet · Datadog.Trace +1)
- [CVE-2026-53598](https://cve.now/CVE-2026-53598.md): Prompty: Arbitrary File Read via ${file:path} Reference Expansion (CVSS 7.5, microsoft prompty · prompty +2)
- [CVE-2026-59867](https://cve.now/CVE-2026-59867.md): Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref (CVSS 7.1, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59866](https://cve.now/CVE-2026-59866.md): Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59864](https://cve.now/CVE-2026-59864.md): Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59865](https://cve.now/CVE-2026-59865.md): Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by kiota info (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59863](https://cve.now/CVE-2026-59863.md): Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF (CVSS 7.0, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59859](https://cve.now/CVE-2026-59859.md): Kiota: Code Generation Literal Injection in the PHP Generator (CVSS 8.7, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59862](https://cve.now/CVE-2026-59862.md): Kiota: Code Generation Literal Injection in the Python Generator (CVSS 7.5, microsoft kiota · Microsoft.OpenAPI.Kiota +1)
- [CVE-2026-59861](https://cve.now/CVE-2026-59861.md): Kiota: Code Generation Literal Injection in Kiota Ruby Generator (CVSS 7.5, microsoft kiota · Microsoft.OpenAPI.Kiota +1)
- [CVE-2026-59860](https://cve.now/CVE-2026-59860.md): Kiota: XML Doc-Comment Newline Breakout Code Injection (CVSS 8.7, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-61872](https://cve.now/CVE-2026-61872.md): ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder (CVSS 2.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61871](https://cve.now/CVE-2026-61871.md): ImageMagick before 7.1.2-26 Memory Leak in ICON decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61869](https://cve.now/CVE-2026-61869.md): ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61868](https://cve.now/CVE-2026-61868.md): ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61867](https://cve.now/CVE-2026-61867.md): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61866](https://cve.now/CVE-2026-61866.md): ImageMagick before 7.1.2-26 Memory Leak in JNG encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61865](https://cve.now/CVE-2026-61865.md): ImageMagick before 7.1.2-26 Memory Leak in Hough Lines (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61864](https://cve.now/CVE-2026-61864.md): ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61863](https://cve.now/CVE-2026-61863.md): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61862](https://cve.now/CVE-2026-61862.md): ImageMagick before 7.1.2-26 Information Disclosure via identify (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61860](https://cve.now/CVE-2026-61860.md): ImageMagick before 7.1.2-26 Use-After-Free via freetype (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61859](https://cve.now/CVE-2026-61859.md): ImageMagick before 7.1.2-26 Policy Bypass via script operation (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61464](https://cve.now/CVE-2026-61464.md): ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11 (CVSS 1.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56375](https://cve.now/CVE-2026-56375.md): ImageMagick - Memory Leak in ASHLAR Coder Action Failure (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-50659](https://cve.now/CVE-2026-50659.md): .NET Spoofing Vulnerability (CVSS 6.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +15)
- [CVE-2026-50651](https://cve.now/CVE-2026-50651.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14)
- [CVE-2026-50650](https://cve.now/CVE-2026-50650.md): .NET Framework Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7)
- [CVE-2026-50648](https://cve.now/CVE-2026-50648.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-50646](https://cve.now/CVE-2026-50646.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7)
- [CVE-2026-50528](https://cve.now/CVE-2026-50528.md): .NET Security Feature Bypass Vulnerability (CVSS 8.2, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14)
- [CVE-2026-50527](https://cve.now/CVE-2026-50527.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-50526](https://cve.now/CVE-2026-50526.md): .NET Tampering Vulnerability (CVSS 7.0, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3)
- [CVE-2026-50525](https://cve.now/CVE-2026-50525.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-50524](https://cve.now/CVE-2026-50524.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14)
- [CVE-2026-47304](https://cve.now/CVE-2026-47304.md): .NET Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-47303](https://cve.now/CVE-2026-47303.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3)
- [CVE-2026-47302](https://cve.now/CVE-2026-47302.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +16)
- [CVE-2026-47300](https://cve.now/CVE-2026-47300.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3)
- [CVE-2026-57108](https://cve.now/CVE-2026-57108.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +9)
- [CVE-2026-56170](https://cve.now/CVE-2026-56170.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +13)
- [CVE-2026-61870](https://cve.now/CVE-2026-61870.md): ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61861](https://cve.now/CVE-2026-61861.md): ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61858](https://cve.now/CVE-2026-61858.md): ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61857](https://cve.now/CVE-2026-61857.md): ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61465](https://cve.now/CVE-2026-61465.md): ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56372](https://cve.now/CVE-2026-56372.md): ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56373](https://cve.now/CVE-2026-56373.md): ImageMagick - Use-After-Free Write in PDB Decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56366](https://cve.now/CVE-2026-56366.md): ImageMagick - Memory Leak in META Reader APP1JPEG Error Path (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-54782](https://cve.now/CVE-2026-54782.md): CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation (CVSS 10.0, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54781](https://cve.now/CVE-2026-54781.md): CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54784](https://cve.now/CVE-2026-54784.md): CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54774](https://cve.now/CVE-2026-54774.md): CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54783](https://cve.now/CVE-2026-54783.md): CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54780](https://cve.now/CVE-2026-54780.md): CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass (CVSS 3.7, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54775](https://cve.now/CVE-2026-54775.md): CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core (CVSS 6.5, CoreWCF · CoreWCF.Kafka)
- [CVE-2026-54778](https://cve.now/CVE-2026-54778.md): CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution (CVSS 6.2, CoreWCF · CoreWCF.UnixDomainSocket)
- [CVE-2026-54773](https://cve.now/CVE-2026-54773.md): CoreWCF: WS-Security signature substitution via document-wide Signature lookup (CVSS 5.9, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54779](https://cve.now/CVE-2026-54779.md): CoreWCF: SAML token replay protection is inoperative (CVSS 5.9, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54772](https://cve.now/CVE-2026-54772.md): CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake (CVSS 7.5, CoreWCF · CoreWCF.NetFramingBase)
- [CVE-2026-54776](https://cve.now/CVE-2026-54776.md): CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade (CVSS 4.4, CoreWCF · CoreWCF.UnixDomainSocket)
- [CVE-2026-40372](https://cve.now/CVE-2026-40372.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 9.1, Microsoft ASP.NET Core · Microsoft Visual Studio +2)
- [CVE-2020-8927](https://cve.now/CVE-2020-8927.md): Buffer overflow in Brotli library (CVSS 5.3, Google Brotli · brotli +122)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/nuget
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.